Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.3

Trend Micro Deep Security 20.0: Local Privilege Escalation Risk

CVE-2024-55955 · published 1 year ago
Summary

Some versions of Trend Micro Deep Security 20.0 have a flaw that could allow a hacker who already has some access to a system to gain more powerful access. This means they could potentially do more harm than they normally could. Update your Deep Security agents to the latest version to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
trendmicro deep_security_agent 20.0.1
cpe:2.3:a:trendmicro:deep_security_agent:20.0.1:update12510:*:*:long_term_support:*:*:*
Original advisory text
An incorrect permissions assignment vulnerability in Trend Micro Deep Security 20.0 agents between versions 20.0.1-9400 and 20.0.1-23340 could allow a local attacker to escalate privileges on affec...
An incorrect permissions assignment vulnerability in Trend Micro Deep Security 20.0 agents between versions 20.0.1-9400 and 20.0.1-23340 could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-427Uncontrolled Search Path Element
CWE-732Incorrect Permission Assignment for Critical Resource
Timeline
Published31 Dec 2024
Updated26 Oct 2026
First seen7 Mar 2026
Sources
CVE-2024-55955 · NVD
Track software like this
Free during beta